Method for controlling a motor vehicle remotely

ABSTRACT

A method for controlling a motor vehicle remotely. The method includes: receiving safety condition signals, which represent at least one safety condition that must be satisfied, so that the motor vehicle may be controlled remotely; checking if the at least one safety condition is satisfied; generating remote control signals for controlling the motor vehicle remotely, based on a result of the check as to whether the at least one safety condition is satisfied; and outputting the remote control signals generated. A device, a computer program and a machine-readable storage medium, are also described.

CROSS REFERENCE

The present application claims the benefit of German Patent ApplicationNo. DE 102019214461.6 filed on Sep. 23, 2019, which is expresslyincorporated herein by reference in its entirety.

FIELD

The present invention relates to a method for controlling a motorvehicle remotely. In addition, the present invention relates to adevice, a computer program and a machine-readable storage medium.

BACKGROUND INFORMATION

German Patent Application No. DE 10 2016 213 961 A1 describes a designfor controlling a motor vehicle remotely within a parking lot.

German Patent Application No. DE 10 2017 213 204 A1 describes a methodand a system for controlling a vehicle remotely.

German Patent Application No. DE 10 2018 107 756 A1 describes systemsfor outputting a warning signal of a vehicle, in order to warn entitiessituated in the vicinity.

PCT Application No. WO 2019/028464 A1 describes a vehicle drivingautonomously.

SUMMARY

An object of the present invention is to provide a way to control avehicle remotely in an efficient manner.

This object may be achieved in accordance with example embodiments ofthe present invention. Advantageous refinements of the present inventionare described herein.

According to a first aspect of the present invention, an example methodfor controlling a motor vehicle remotely is provided, including thefollowing steps:

Receiving safety condition signals, which represent at least one safetycondition that must be satisfied, so that the motor vehicle may becontrolled remotely;

checking if the at least one safety condition is satisfied; generatingremote control signals for controlling the motor vehicle remotely, basedon a result of the check as to whether the at least one safety conditionis satisfied;

outputting the remote control signals generated.

According to a second aspect of the present invention, an example deviceis provided, which is configured to execute all of the steps of themethod according to the first aspect.

According to a third aspect of the present invention, an examplecomputer program is provided, which includes commands that, in responseto the execution of the computer program by a computer, for example, bythe device according to the second aspect, cause it to implement amethod according to the first aspect.

According to a fourth aspect of the present invention, amachine-readable storage medium is provided, in which the computerprogram according to the third aspect is stored.

In accordance with an example embodiment of the present invention, theabove-mentioned object may be achieved by checking, prior to remotecontrol of the motor vehicle, whether the at least one safety conditionhas been satisfied. If this is not the case, then, in particular, thegeneration of remote control signals for controlling the motor vehicleremotely is refrained from. Preferably, the remote control signals areonly generated and outputted, when the at least one safety condition issatisfied.

This produces, for example, the technical advantage that the remotecontrol of the motor vehicle may be carried out safely.

Consequently, in particular, the technical advantage, that a way forefficiently controlling a motor vehicle remotely, is provided.

In one specific example embodiment of the present invention, the remotecontrol signals include control signals for controlling a transverseand/or longitudinal guidance of the motor vehicle.

This may produce, for example, a technical advantage that the motorvehicle may be controlled remotely in an efficient manner.

In one specific example embodiment of the present invention, a step ofdetermining that a motor vehicle should be controlled remotely, isprovided.

In this manner, for example, a technical advantage may be produced, thatit may be ensured in an efficient manner that a motor vehicle isintended to be controlled remotely.

In the case in which the control signals are control signals forcontrolling the lateral or the longitudinal guidance of the motorvehicle, one specific embodiment provides that in each instance, theother guidance, that is, the longitudinal guidance or the lateralguidance, be either controlled manually by the driver (which may then bereferred to, in particular, as assisted driving), or controlled in an atleast semiautomated manner, in order to drive the motor vehicle in an atleast semiautomated manner.

Assisted driving means, in particular, that a driver of the motorvehicle permanently carries out either the lateral guidance or thelongitudinal guidance of the motor vehicle. The other respective drivingtask (that is, controlling the longitudinal or the lateral guidance ofthe motor vehicle) is automatically carried out remotely. Therefore,this means that in the case of assisted driving of the motor vehicle,either the lateral or the longitudinal guidance is controlled remotelyin an automatic manner.

The wording “at least semiautomated guidance” includes one or more ofthe following cases: semiautomated driving, highly automated driving,fully automated driving.

Semiautomated driving means that in a specific situation (for example:driving on an expressway, driving within a parking lot, passing anobject, driving within a traffic lane, which is defined by lanemarkings) and/or for a certain period of time, longitudinal and lateralguidance of the motor vehicle is controlled remotely in an automaticmanner. A driver of the motor vehicle does not have to manually controlthe longitudinal and lateral guidance of the motor vehiclehimself/herself. However, the driver should monitor the automatic,remote control of the longitudinal and lateral guidance continuously, inorder to be able to manually intervene, if necessary. The driver must beready at any time to take over the driving of the motor vehiclecompletely.

Highly automated driving means that for a certain period of time in aspecific situation (for example: driving on an expressway, drivingwithin a parking lot, passing an object, driving within a traffic lane,which is defined by lane markings), longitudinal and lateral guidance ofthe motor vehicle are controlled remotely in an automatic manner. Adriver of the motor vehicle does not have to manually control thelongitudinal and lateral guidance of the motor vehicle himself/herself.The driver does not have to monitor the automatic, remote control of thelongitudinal and lateral guidance continuously, in order to be able tointervene manually, as required. If necessary, a take-over request tothe driver for assuming the control of the longitudinal and lateralguidance is outputted automatically, in particular, outputted withadequate time to spare. Thus, the driver must be potentially able totake over the control of the longitudinal and lateral guidance. Limitsof the automatic, remote control of the lateral and longitudinalguidance are detected automatically. In the case of highly automateddriving, it is not possible to bring about a minimal-risk stateautomatically in every initial situation.

Fully automated driving means that in a specific situation (for example:driving on an expressway, driving within a parking lot, passing anobject, driving within a traffic lane, which is defined by lanemarkings), longitudinal and lateral guidance of the motor vehicle iscontrolled remotely in an automatic manner. A driver of the motorvehicle does not have to manually control the longitudinal and lateralguidance of the motor vehicle himself/herself. The driver does not haveto monitor the automatic, remote control of the longitudinal and lateralguidance, in order to be able to intervene manually, when necessary.Prior to an end of the automatic remote control of the lateral andlongitudinal guidance, a request for the driver to take over the drivingtask (controlling the lateral and longitudinal guidance of the motorvehicle) is made automatically, in particular, with adequate time tospare. If the driver does not assume the driving task, then a return ismade automatically to a minimum-risk state. Limits of the automaticcontrol of the lateral and longitudinal guidance are detectedautomatically. In all situations, it is possible to return automaticallyto a minimum-risk system state.

According to one specific example embodiment, it is provided that the atleast one safety condition is, in each instance, an element selectedfrom the following group of safety conditions: presence of apredetermined safety integrity level (SIL) or automotive safetyintegrity level (ASIL) of at least the motor vehicle and aninfrastructure, in particular, including a communication path and/orcommunications components, for controlling a motor vehicle remotely (inparticular, with regard to the overall systems in the motor vehicle andinfrastructure, as well as, in particular, parts, e.g., components,algorithms, interfaces, etc.; presence of a maximum latency time of acommunication between the motor vehicle and a remote control device forcontrolling the motor vehicle remotely on the basis of the remotecontrol signals; presence of a predetermined computer protection levelof a device for executing the method steps; presence of predeterminedcomponents and/or algorithms and/or communication options, which areused for executing the method steps; presence of redundancy and/ordiversity in predetermined components and/or algorithms and/orcommunication options, which are used for executing the method steps;presence of predetermined availability information, which indicates anavailability of predetermined components and/or algorithms and/orcommunication options; presence of predetermined quality criteria of thepredetermined components and/or algorithms and/or communication options;presence of a plan, which includes measures for reducing faults and/ormeasures in response to failures of predetermined components and/oralgorithms and/or communication options and/or measures for incorrectanalyses and/or measures in response to incorrect interpretations;presence of one or more fallback scenarios; presence of a predeterminedfunction; presence of a predetermined traffic situation; presence ofpredetermined weather, maximum possible time for a specific performanceor execution of one method step or a plurality of method steps; presenceof a test result, that elements or functions, which are used forexecuting the method, are presently functioning correctly.

A communication path is, for example, a communication path between thedevice according to the second aspect, and the motor vehicle. Acommunication path includes, for example, one or more communicationchannels.

In one specific embodiment of the present invention, a component, whichis used for executing the method according to the first aspect, is anelement selected from the following group of components: surroundsensor, motor vehicle, infrastructure, remote control device, deviceaccording to the second aspect, motor vehicle system, in particular,drive system, clutch system, brake system, driver assistance system,communications interface of the motor vehicle or of the infrastructure,processor, input, output of the device according to the second aspect.

In one specific embodiment of the present invention, a function, whichis used for executing the method according to the first aspect, is anelement selected from the following group of functions: remote controlfunction, communication function between the motor vehicle and theinfrastructure or the remote control device, evaluation function ofsurround sensor data of a surround sensor, planning function, inparticular, travel planning function, traffic analysis function,emissions analysis function.

The following determines, in particular, a computer protection level:activated firewall and/or valid encryption certificate for encryption ofa communication between the motor vehicle and the infrastructure or theremote control device, and/or activated virus program including currentvirus signatures, and/or presence of a protection, in particular,mechanical protection, in particular, anti-intrusion protection, of thecomputer, in particular, of the device according to the second aspect,or of the remote control device, and/or presence of an option forchecking that signals, in particular, remote control signals orsurrounding-area signals, have been transmitted correctly, that is,error-free.

An algorithm includes, for example, the computer program according tothe third aspect.

Since, in particular, it is checked that redundancy and/or diversity ispresent in predetermined components and/or algorithms and/orcommunication options, for example, a technical advantage is provided,that in the case of failure of the corresponding component, for example,a computer, or the corresponding algorithm or the correspondingcommunication option, nevertheless, safe functioning may be implemented.

In order to ensure that results are correct, according to one specificembodiment, these may be computed several times, for example, and thecorresponding results may be compared to each other. For example, it isonly determined that the results are correct, if the results agree.

If an odd number occurs several times, then it may be determined, forexample, that the result corresponding to the highest number of equalresults is correct.

For example, remote control signals are only generated, when it is ableto be determined that the result is correct.

In one specific example embodiment of the present invention, the remotecontrol signals are generated only when the at least one safetycondition is satisfied.

In one specific example embodiment of the present invention, the checkas to whether the at least one safety condition is satisfied is carriedout prior to and/or after and/or during one or more predetermined methodsteps.

In particular, this produces the technical advantage that it may beensured in an efficient manner, that certain conditions, presently, thesafety condition, are satisfied for controlling the motor vehicleremotely prior to and/or after and/or during the execution of thecorresponding method steps. Consequently, in particular, the technicaladvantage is produced, that if the safety condition is met, the remotecontrol of the motor vehicle is then safely possible.

In one specific example embodiment of the present invention, it isprovided that after the outputting of the remote control signals, remotecontrol of the motor vehicle is checked on the basis of the outputtedremote control signals, in order to detect a fault; in response to thedetection of a fault, the remote control being broken off, or emergencyremote control signals for controlling the lateral and/or longitudinalguidance of the motor vehicle remotely in an emergency being generatedand outputted.

The emergency remote control signals are, for example, such, that in thecase of the remote control of the lateral and/or longitudinal guidanceof the motor vehicle on the basis of the emergency remote controlsignals, the motor vehicle is carried over into a safe state, inparticular, stopped.

In one specific example embodiment of the present invention, it isprovided that after the outputting of the remote control signals, remotecontrol of the motor vehicle is checked on the basis of the outputtedremote control signals, in order to detect a fault; in response to thedetection of a fault, the remote control being interrupted, or internalmotor vehicle emergency remote control signals for controlling thelateral and/or longitudinal guidance of the motor vehicle in anemergency being generated and outputted.

The internal motor vehicle emergency remote control signals are, forexample, such, that in the case of the control of the lateral and/orlongitudinal guidance of the motor vehicle on the basis of the internalmotor vehicle emergency remote control signals, the motor vehicle iscarried over into a safe state, in particular, stopped.

Thus, internal motor vehicle emergency control signals are emergencycontrol signals, which the motor vehicle generates itself and/or aregenerated in the motor vehicle.

For example, this produces the technical advantage that in the event ofa breakdown of communication, as well, which corresponds, for example,to an emergency, between the motor vehicle and the device according tothe second aspect, that is, a remote control device for controlling themotor vehicle remotely, the motor vehicle may carry itself over into asafe state.

Explanations, which are made in connection with the remote controlsignals and/or the internal motor vehicle emergency control signals,apply analogously to the emergency remote control signals, and viceversa.

According to a further specific example embodiment of the presentinvention, the testing of the remote control includes the check as towhether the at least one safety condition is fulfilled; it beingdetermined that a result, which indicates that the at least one safetycondition is not met, is a fault.

This produces, for example, the technical advantage that an efficientresponse may be made, when the at least one safety condition is nolonger satisfied during the remote control of the motor vehicle on thebasis of the generated remote control signals.

According to one specific example embodiment of the present invention,the testing of the remote control includes a check as to whether aresult to be achieved by the remote control is achieved; it beingdetermined that a result of the check as to whether a result to beachieved by the remote control is achieved, which indicates that theresult to be achieved by the remote control has not been achieved, is afault.

For example, this produces the technical advantage that thenon-achievement of a result to be achieved by the remote control may beresponded to efficiently.

A result to be achieved includes, for example, one or more of thefollowing results: motor vehicle has a predetermined setpoint speed;motor vehicle has a predetermined setpoint acceleration; motor vehicleis located at a predetermined setpoint position; a navigation system ofthe motor vehicle has a predetermined setpoint target position and/or apredetermined, intended route; a motor vehicle device has assumed apredetermined motor vehicle setting.

According to one specific example embodiment of the present invention,as an additional alternative to interrupting the remote control and togenerating and outputting the emergency remote control signals, furtherremote control signals for controlling the motor vehicle remotely on thebasis of the result to be achieved are generated and outputted, in orderto still achieve the result to be achieved in the case of controllingthe motor vehicle remotely on the basis of the further remote controlsignals.

This may produce, for example, a technical advantage that a further,efficient possibility that the result to be achieved by the remotecontrol will still be achieved after all.

According to one specific example embodiment of the present invention,emergency plan signals are received, which represent an emergency planspecific to the detected fault; and the emergency remote control signalsare generated on the basis of the specific emergency plan.

A technical advantage of this is, for example, that the emergency remotecontrol signals may be generated efficiently. Thus, this means, inparticular, that the emergency plan is specifically for the detectedfault.

According to one specific example embodiment of the present invention,the determination, that a motor vehicle should be controlled remotely,includes a determination, that the motor vehicle should be controlledremotely at a predetermined time; the check as to whether the at leastone safety condition is satisfied including a check as to whether the atleast one safety condition is satisfied at the predetermined time.

This produces, for example, a technical advantage that the check as towhether the at least one safety condition is satisfied, may be carriedout efficiently. This provides, in particular, the technical advantagethat it may be checked, in an efficient manner, if the at least onesafety condition will be satisfied at the time, when the motor vehicleis intended to be controlled remotely.

In one specific example embodiment of the present invention, the checkas to whether the at least one safety condition is satisfied includes acheck as to whether the at least one safety condition is satisfied at apredetermined time.

This may provide, in particular, the technical advantage that it may bechecked, in an efficient manner, if the at least one safety conditionwill be satisfied at the time, when the motor vehicle is intended to becontrolled remotely.

For example, time signals are received, which indicate a predeterminedtime at which the motor vehicle is intended to be controlled remotely.

In one specific example embodiment of the present invention, it isprovided that situation signals be received, which represent a situationin which the motor vehicle finds itself; table signals being received,which represent a table that affixes predetermined situations topredetermined requirements for controlling a motor vehicle remotely; thesituation, in which the motor vehicle finds itself, being assigned toone of the predetermined situations; the remote control signals beinggenerated on the basis of the requirement for controlling a motorvehicle, corresponding to the one predetermined situation.

A technical advantage of this is, for example, that the remote controlsignals may be generated efficiently.

According to one specific example embodiment of the present invention,surrounding-area signals are received, which represent a surroundingarea of the motor vehicle; the remote control signals being generated onthe basis of the surrounding area.

This produces, for example, the technical advantage that the remotecontrol signals may be generated efficiently. In particular, thisproduces the technical advantage that a surrounding area of the motorvehicle may be taken into account efficiently during the generation ofthe remote control signals.

According to one specific example embodiment of the present invention,it is checked, on the basis of the surrounding area of the motorvehicle, if a current traffic situation permits remote control of themotor vehicle. In particular, the remote control signals are generatedor outputted on the basis of a result of the check as to whether thecurrent traffic situation permits remote control.

For example, remote control of the motor vehicle is refrained from, whenthe current traffic situation does not permit remote control.

This produces, for example, the technical advantage that other roadusers in the surroundings of the motor vehicle are not put at risk orinjured.

According to one specific example embodiment of the present invention,one or more method steps up to the steps of generating and outputtingthe remote control signals are executed in the motor vehicle, and/or oneor more method steps are executed outside of the motor vehicle, inparticular, in an infrastructure, preferably, in a cloud infrastructure.

This produces, for example, the technical advantage that thecorresponding method steps may be carried out in an efficientlyredundant manner. In particular, this may further increase safety in anadvantageous manner.

According to one specific example embodiment of the present invention,one or more method steps are documented, in particular, documented in ablockchain.

A technical advantage of this is, for example, that on the basis of thedocumentation, this may also be analyzed subsequently after theperformance or execution of the method. In particular, documentation ina blockchain has the technical advantage that the documentation is safefrom manipulation and falsification.

A blockchain (also block chain) is, in particular, a continuouslyexpandable list of data records, called blocks, which are linkedtogether with the aid of one or more cryptographic methods. In thiscontext, each block contains, in particular, a cryptographically securehash (standard value of deviation) of the preceding block, inparticular, a time stamp and, in particular, transactional data.

According to one specific example embodiment of the present invention,outputting the generated remote control signals includes transmittingthe remote control signals over a communications network, in particular,over a wireless communications network, to the motor vehicle.

According to one specific example embodiment of the present invention,the method according to the first aspect includes controlling the motorvehicle remotely on the basis of the generated remote control signals.

In one specific example embodiment of the present invention, it istested if an entity made up of the motor vehicle and the infrastructureinvolved in the method, including communication between theinfrastructure and the motor vehicle, is safe, so that the motor vehicleand/or a local and/or a global infrastructure and/or communicationbetween the motor vehicle and the infrastructure are tested accordingly.In particular, the remote control signals are generated on the basis ofa result of the test.

Thus, this means, in particular, that the components, which are usedduring the execution of the method according to the first aspect, aretested for safety, that is, as to whether these satisfy specific safetyconditions, before the intervention in the vehicle operation is carriedout, that is, before the motor vehicle is controlled remotely.

Important or dependent criteria include, for example, one or more of thesafety conditions described above.

In one specific example embodiment of the present invention, the remotecontrol signals include adjustment signals for adjusting at least onemotor vehicle setting of a motor vehicle device of the motor vehicle.

This produces, for example, the technical advantage that the at leastone motor vehicle setting may be adjusted remotely in an efficientmanner.

The at least one motor vehicle setting is, for example, in eachinstance, an element selected from the following group of motor vehiclesettings: internal combustion engine setting, in particular, injectionparameters, of an internal combustion engine of the motor vehicle;operating state of an electric motor of the motor vehicle; permissiblemaximum speed of the motor vehicle; permissible maximum acceleration ofthe motor vehicle; navigation data, in particular, destination and/orroute; setting of the motor vehicle lighting.

The at least one motor vehicle device is, for example, in each instance,an element selected from the following group of motor vehicle devices:steering system; brake system; drive system; gear unit; surround sensorsystem of the motor vehicle, including one or more surround sensors;drive motor; motor vehicle lighting; navigation system.

Therefore, this means that the remote control signals do not necessarilyhave to control lateral and/or longitudinal guidance of the motorvehicle, but may adjust one or more motor vehicle parameters or motorvehicle settings, in particular, a drive setting and/or navigationsetting.

According to one specific example embodiment of the present invention,it is provided that the method according to the first aspect be acomputer-implemented method.

According to one specific example embodiment of the present invention,the method according to the first aspect is executed or performed withthe aid of the device according to the second aspect.

Device features follow analogously from corresponding method features,and vice versa. Thus, this means that, in particular, technicalfunctions of the device according to the second aspect followanalogously from corresponding instances of technical functionality ofthe method according to the first aspect, and vice versa.

The wording “at least one” stands, in particular, for “one or more.”Exemplary embodiments of the present invention are represented in thefigures and explained in greater detail in the description below.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 shows a flow chart of a method for controlling a motor vehicleremotely in accordance with an example embodiment of the presentinvention.

FIG. 2 shows a device in accordance with an example embodiment of thepresent invention.

FIG. 3 shows a machine-readable storage medium in accordance with anexample embodiment of the present invention.

FIG. 4 shows a motor vehicle within an infrastructure in accordance withan example embodiment of the present invention.

DETAILED DESCRIPTION OF EXAMPLE EMBODIMENTS

FIG. 1 shows a flow chart of an example method for controlling a motorvehicle remotely in accordance with an example embodiment of the presentinvention, including the following steps:

Determining 101 that a motor vehicle should be controlled remotely;receiving 103 safety condition signals, which represent at least onesafety condition that must be satisfied, so that the motor vehicle maybe controlled remotely;

checking 105 if the at least one safety condition is satisfied;

generating 107 remote control signals for controlling the motor vehicleremotely, based on a result of the check as to whether the at least onesafety condition is satisfied;

outputting 109 the remote control signals generated.

At this point, it is noted that the determining step 101 is an optionalstep. In one further specific embodiment, the determining step 101 maynot be included in the method according to the first aspect.

In one specific embodiment, it is provided that request signals bereceived, which represent a request for controlling a motor vehicleremotely.

According to one specific example embodiment of the present invention,it is determined, in response to the receipt of the request signals,that a motor vehicle is intended to be controlled remotely.

In one specific example embodiment of the present invention, it isprovided that situation signals be received, which represent a situationin which a motor vehicle finds itself. According to one specific exampleembodiment of the present invention, the situation signals areprocessed, in order to ascertain if the motor vehicle must be controlledremotely. According to one specific example embodiment of the presentinvention, if it is ascertained that the motor vehicle must becontrolled remotely, then it is determined that the motor vehicle isintended to be controlled remotely.

For example, the motor vehicle may be in a situation, which the motorvehicle is not able to resolve or overcome independently. Then, forexample, it is determined that the motor vehicle should be controlledremotely.

The result of the check indicates, for example, that the at least onesafety condition is satisfied. The result of the check indicates, forexample, that the at least one safety condition is not satisfied.

In one specific example embodiment according to the present invention,it is provided that the remote control signals only be generated, whenthe result of the check indicates that the at least one safety conditionis satisfied.

In one specific example embodiment according to the present invention,it is provided that the generation of remote control signals berefrained from, if the result of the check indicates that the at leastone safety condition is not satisfied.

According to one specific example embodiment of the present invention,the outputting 109 includes that the generated remote control signalsare transmitted over a communications network, in particular, over awireless communications network, to the motor vehicle.

According to one specific example embodiment of the present invention,the method according to the first aspect includes the step ofcontrolling the motor vehicle remotely on the basis of the outputtedremote control signals.

FIG. 2 shows a device 201.

Device 201 is configured to execute all of the steps of the methodaccording to the first aspect.

Device 201 includes an input, which is configured to receive the safetycondition signals.

Device 201 further includes a processor 205, which is configured tocheck if the at least one safety condition is satisfied.

In a further specific embodiment (not shown), processor 205 isconfigured, in particular, to determine that a motor vehicle should becontrolled remotely.

Processor 205 is further configured to generate the remote controlsignals.

Device 201 further includes an output 207, which is configured to outputthe remote control signals generated.

According to one specific example embodiment of the present invention,device 201 includes a remote control device, which is configured tocontrol the motor vehicle remotely on the basis of the remote controlsignals outputted.

In general, signals, which are received, are received with the aid ofinput 203. Thus, input 203 is configured, in particular, to receive thecorresponding signals.

In general, signals, which are outputted, are outputted with the aid ofoutput 207. Thus, output 207 is configured, in particular, to output thecorresponding signals.

According to one specific example embodiment of the present invention, aplurality of processors are provided in place of the one processor 205.

According to one specific example embodiment of the present invention,processor 205 is configured to execute the generating and checking stepsdescribed above and/or in the following.

In one specific example embodiment of the present invention, one or moremethod steps up to the steps of generating and outputting the remotecontrol signals are executed inside the motor vehicle, and/or one ormore method steps are executed outside of the motor vehicle, inparticular, in an infrastructure, preferably, in a cloud infrastructure.

Device 201 is, for example, part of an infrastructure, in particular,cloud infrastructure, or part of the motor vehicle.

According to one specific example embodiment of the present invention,for redundant execution of the corresponding method steps, a pluralityof devices 201 may be provided, so that, for example, both the motorvehicle and the infrastructure, in particular, the cloud infrastructure,include a device 201.

FIG. 3 shows a machine-readable storage medium 301.

A computer program 303 is stored in machine-readable storage medium 301;the computer program including commands, which, in response to executionof computer program 303 by a computer, cause it to implement a methodaccording to the first aspect.

According to one specific example embodiment of the present invention,an infrastructure or an infrastructure system is provided, whichincludes, for example, the device according to the second aspect.

FIG. 4 shows a motor vehicle 401, which travels inside of aninfrastructure 403.

Infrastructure 403 includes a road 405, on which motor vehicle 401travels.

Infrastructure 403 further includes a surround sensor 407, a trafficlight 409 and a cloud infrastructure 411, in which, for example, thedevice according to the second aspect is situated and/or provided.

In a specific embodiment not shown, infrastructure 403 includes aplurality of surround sensors, which are positioned so as to bespatially distributed within the infrastructure.

The surround sensors of infrastructure 403 monitor their respectivesurroundings and supply surround sensor data corresponding to therespective monitoring.

The surrounding-area signals described here are based on the surroundsensor data and/or include the surround sensor data.

In a specific embodiment not shown, in addition to, or in place of,traffic light 409, infrastructure 403 includes further traffic systems,such as signs and communication systems.

Motor vehicle 401 includes a roof-side surround sensor 413.

According to FIG. 4, the two surround sensors 407, 413 are representedillustratively as a video camera. It is noted that every surround sensordescribed here may be used.

In a specific embodiment not shown, in addition to, or in place ofsurround sensor 413, motor vehicle 401 may even include additionalsurround sensors, which are situated, for example, at the front endand/or rear end and/or on a side of the motor vehicle.

In addition, three double arrows 415, 417, 419 are drawn in FIG. 4.

These symbolize a specific communication path and/or a specificcommunication channel between individual elements represented in FIG. 4.

Thus, the double arrow having reference numeral 415 symbolizes acommunication path between motor vehicle 401 and cloud infrastructure411.

The double arrow having reference numeral 417 symbolizes a communicationpath between surround sensor 407 of infrastructure 403 and cloudinfrastructure 411.

The double arrow having reference numeral 419 symbolizes a communicationpath between motor vehicle 401 and traffic light 409.

In order that motor vehicle 401 may be controlled remotely, according tothe concept described here, there is a condition that the entity made upof motor vehicle 401 and elements involved in the method according tothe first aspect be safe, that is, safe and secure.

Thus, the elements involved in the method according to the first aspectpresently include, in particular, infrastructure 403 and motor vehicle401. Therefore, according to the exemplary embodiment shown in FIG. 4,the elements of infrastructure 403 are cloud infrastructure 411,surround sensor 407 and traffic light 409.

The specific communication paths 415, 417, 419 between the respectiveelements also belong to the entity.

Therefore, this means, in particular, that, for example, a communicationpath 415 between motor vehicle 401 and cloud infrastructure 411 ischecked as to whether it is secure.

Accordingly, it is checked, for example, if surround sensor 407 issecure.

According to the present invention, one or more safety conditions arespecified as criteria for whether a communication path and/or an elementof the entity are secure; the safety conditions having to be satisfied,in order that it may be determined that the corresponding element and/orthe corresponding communication path are secure.

For example, a communication path between two elements must have aminimum latency time, in order that the communication path be regardedas secure.

For example, a surround sensor must satisfy certain quality criteria, inorder for it to be regarded as reliable.

For example, a surround sensor data processing algorithm, which isexecuted in a device in cloud infrastructure 411 according to the secondaspect must have certain quality specifications.

For example, specific emergency plans must be stored or saved in cloudinfrastructure 411, in order that the motor vehicle may be controlledremotely.

In one specific embodiment, remote control includes a change in thedrive unit (e.g., for reducing emissions, limiting the speed) and/orspecifying a trajectory to be covered (e.g., on the basis ofrequirements, preventing accidents).

Therefore, this means, in particular, that the remote control signalsinclude adjustment signals for adjusting a drive setting of the driveunit of the motor vehicle, and/or for adjusting a navigation setting ofa navigation system of the motor vehicle.

Therefore, this means that the remote control signals do not necessarilyhave to control lateral and/or longitudinal guidance of the motorvehicle, but may adjust one or more motor vehicle parameters or motorvehicle settings, in particular, a drive setting and/or navigationsetting.

In one specific embodiment, in the run-up to the intervention (of theremote control), and according to a further specific embodiment, duringthe intervention, it is ensured that the intervention and/or the actionresulting from it are safe, which means, inter alia, that theintervention does not result in any accidents. Accompanying this, thismeans, in particular, that the term “safe” and “secure” is necessary,which means, inter alia, that hackers do not change therequirements/actions (For a further explanation of these two Englishterms, reference is made to the explanations following further down.).

In one specific embodiment, for example, the following is provided:

Analyzing or checking if the at least one safety condition is satisfied.In this case, it is checked, for example, when the remote controlis/would be safe for intervention from the outside.

Analyzing or checking if the at least one safety condition is satisfiedat the time of the desired intervention.

If yes, carrying out the remote control by generating and outputtingcorresponding remote control signals.

If no, carrying out no remote control, that is to say, not carrying outthe remote control. Therefore, no generation and outputting ofcorresponding remote control signals.

In a further specific embodiment, during the intervention (of the remotecontrol), it is additionally tested, at regular intervals, if the atleast one safety condition continues to be satisfied.

In the case, in which the at least one safety condition is no longersatisfied, for example, emergency remote control signals are generatedand outputted on the basis of a specific emergency plan. Preferably,specific emergency plans are analyzed and defined in advance for eachpossible, individual fault. One emergency plan may be, for example, tobring the vehicle to a dead stop, that is, to a safe driving state, asrapidly as possible. Preferably, in consideration/view of thesurroundings, and while warning other road users.

In a further specific example embodiment of the present invention,during the intervention (of the remote control), it is additionallytested, at regular intervals, if the planned remote control and/or itsplanned result occurs.

If this is not the case, then, for example, a reactionary action iscarried out.

In one specific example embodiment of the present invention, areactionary action may include an additional action, which continues topursue the original result. E.g., even more deceleration and even moremotive power, in order to still attain, e.g., the desired speed afterall.

In one further specific example embodiment of the present invention, areactionary action may include, that the action is interrupted, since itis no longer effective.

In a further specific example embodiment of the present invention, onthe basis of an emergency plan, emergency remote control signals aregenerated and outputted as a function of the situation/fault.

In a further specific example embodiment of the present invention, onthe basis of an emergency plan, emergency remote control signals aregenerated and outputted, in particular, especially in the cases offaults.

The check as to whether the at least one safety condition is satisfied,is based, in particular, on a check as to the requirements and/orconditions, under which the planned remote control is safe.

In this context, the risks, which the action (the remote control) couldhave, are first analyzed, for example. Especially, whether accidentsincluding damage (to motor vehicles, etc.), but, in particular,including injuries and/or death to parties involved, may be the result.

Then, according to one specific embodiment, it is subsequently tested,how these results may be prevented.

In this context, in particular, it is determined how faults are treated,that is, whether, and if yes, which reactionary actions and/or emergencyplans (fallback actions) should be carried out.

In this context, there are, in particular, static requirements and/orconditions and/or, in particular, dynamic requirements and/orconditions, namely, in particular, for the overall system, which ispreferably made up of at least a motor vehicle, infrastructure (inparticular, traffic systems, sensors and components in theinfrastructure), computer systems in the infrastructure and/or in acloud, and a communication path (e.g., WLAN/WIFI and/or mobile radiocommunication).

The requirements are in force, in particular, for the overall systemand, in the following, in particular, for all parts of the overallsystem.

In this context, static requirements and/or conditions are preferablyanalyzed beforehand (prior to remote control) and, as a rule, do notchange over time. E.g., which components are present in the operation,and how safe (“safe and secure”) are they (in general).

In this context, the current state of dynamic requirements and/orconditions may not be analyzed beforehand and are a function of thecurrent situation. For example:

How is the current environment (number of road users, weather, . . . )?

Do the components currently function in a faultless manner?

However, how which states of the dynamic requirements and/or conditionspresent at the moment are to be reacted to, is preferably analyzedbeforehand. Thus, e.g., may the action (the remote control) be carriedout. Or, may the action only be carried out in a limitedmanner/partially/with restrictions.

In the case of the static requirements or conditions, in particular, thequality, which the overall system must have, and/or the quality, whichthe involved components must have (availabilities, failure rates,accuracies, . . . ), and/or the quality, which the participatingalgorithms, methods, procedures (e.g., tests, operations, redundantcalculations, . . . ) must have, are analyzed.

In addition, how the overall relationships must be, is particularlyanalyzed. E.g., the overall dynamic behavior across systems and,consequently, over the individual systems/methods. E.g., how rapidly,where, and how must something be calculated and transmitted (e.g.,latency behavior).

In this context, for example, the following are checked (as a functionof the specific remote control): (A)SIL's of the overall system,(A)SIL's of the components, (A)SIL's of the procedures/methods, latencytimes and bandwidths for data transmissions, times forcalculations/communications,/reaction functions, safety methodologies(hacker protection), optionally, necessary, redundant/diversitarycomponents/algorithm/communication options, quality ofservices/availability data/measures for reducingfaults/failures/incorrect analyses/misinterpretations, fallbackscenarios, premises regarding function/traffic situation/ . . . ,premises regarding weather/ . . . , etc.

To this end (for development, analysis of the quality, etc.), there are,inter alia, rules, standards, etc.:

https://de.wikipedia.org/wiki/Sicherheitsanforderungsstufe (safetyrequirement step)

https://de.wikipedia.org/wiki/ISO_26262

This means, in particular, that requirements/conditions, under which theaction can/may be carried out without consequences (accidents, seriouslyinjured persons, fatalities), are analyzed.

In the analysis as to whether the requirements are met at the time ofthe desired intervention, it is then tested, for example, if therequirements (static, dynamic) are currently fulfilled, that is,satisfied.

And in the following, remote control signals are then generated andoutputted accordingly, or simply not, as a function of a result of theanalysis.

In this context, the check tests (Requirements currently present? Is theaction being carried out correctly? . . . ) may or should preferably becarried out several times (for safety->safe/secure), in particular,using different methods, in particular, on different systems, as well.Therefore, in particular, the testing and/or checking is carried out ina redundant and diverse manner.

Due to the consequences (fatality, etc.), the operation is preferablydocumented comprehensibly and in a manner safe from falsification, forexample, in a blockchain.

According to one specific embodiment, a condition for the remote controlor for the intervention is that the remote control is safe. In thespirit of the description, “safe” means, in particular, “safe” and“secure.” Actually, these two English terms are normally translated intoGerman as “sicker”. Nevertheless, these have a partially differentmeaning in English.

The term “safe” is directed, in particular, to the topic of accident andaccident prevention. Remote control, which is “safe,” causes, inparticular, a probability of an accident or a collision to be less thanor less than or equal to a predetermined threshold probability value.

The term “secure” is directed, in particular, to the topic of computerprotection and/or hacker protection, that is, in particular, howsecurely is a (computer) infrastructure and/or a communicationsinfrastructure, in particular, a communication path between a motorvehicle and a remote control device for controlling a motor vehicleremotely, protected from unauthorized access and/or from datamanipulation by a third party (hacker).

Thus, remote control, which is “secure,” has, in particular, appropriateand sufficient computer protection and/or hacker protection as a basis.

For example, according to one specific example embodiment of the presentinvention, it is tested if the entity made up of a motor vehicle andinfrastructure involved in the method according to the first aspect,including communication between the infrastructure and the motorvehicle, is currently secure for the plan “intervention in the motorvehicle for critical actions” described here. Therefore, this means, inparticular, that the motor vehicle and/or a local and/or a globalinfrastructure and/or communication are appropriately tested. Inparticular, the remote control signals are generated on the basis of aresult of the test.

Thus, this means, in particular, that the components, which are usedduring the execution of the method according to the first aspect, aretested for safety, that is, as to whether these satisfy specific safetyconditions, before the intervention in the vehicle operation is carriedout, that is, before the motor vehicle is controlled remotely.

Important or dependent criteria include, for example, one or more of thesafety conditions described above.

According to one specific example embodiment of the present invention,first of all, the overall system (motor vehicle, infrastructure,communication path, cloud, . . . ) is tested with regard to the safetycondition.

According to one specific example embodiment of the present invention,the individual parts are also tested with regard to satisfying thesafety condition. This, in particular, prior to controlling the motorvehicle remotely.

In this context, in one specific example embodiment of the presentinvention, the testing step(s) are executed inside the motor vehicleand/or outside the motor vehicle, in particular, in an infrastructure.

According to one specific example embodiment of the present invention,the checking step(s) are tested subsequently, that is, at a later time,for example, at regular intervals. For example, the testing step(s) aretested subsequently at a predetermined frequency, for example, every 100ms.

For example, according to one specific example embodiment of the presentinvention, this testing, that is, the test as to whether the at leastone safety condition is satisfied, is carried out prior to and/or afterand/or during one or more predetermined method steps.

According to one specific example embodiment of the present invention,the testing is carried out or executed in response to problems.

What is claimed is:
 1. A method for controlling a motor vehicleremotely, comprising the following steps: receiving safety conditionsignals, which represent at least one safety condition that must besatisfied, so that the motor vehicle may be controlled remotely;checking whether the at least one safety condition is satisfied;generating remote control signals for controlling the motor vehicleremotely, based on a result of the check as to whether the at least onesafety condition is satisfied; and outputting the generated remotecontrol signals.
 2. The method as recited in claim 1, wherein the atleast one safety condition includes at least one of the following safetyconditions: (i) presence of a predetermined safety integrity level orautomotive safety integrity level of at least the motor vehicle and aninfrastructure including a communication path and/or communicationscomponents, for controlling a motor vehicle remotely, (ii) presence of amaximum latency time of a communication between the motor vehicle and aremote control device for controlling the motor vehicle remotely basedon the remote control signals, (iii) presence of a predeterminedcomputer protection level of a device for executing the method steps,(iv) presence of predetermined components and/or algorithms and/orcommunication options, which are used for executing the method steps,(v) presence of redundancy and/or diversity in predetermined componentsand/or algorithms and/or communication options, which are used forexecuting the method steps, (vi) presence of predetermined availabilityinformation, which indicates an availability of predetermined componentsand/or algorithms and/or communication options, (vii) presence ofpredetermined quality criteria of the predetermined components and/oralgorithms and/or communication options, (viii) presence of a plan,which includes measures for reducing faults and/or measures in responseto failures of predetermined components and/or algorithms and/orcommunication options and/or measures for incorrect analyses and/ormeasures in response to incorrect interpretations; presence of one ormore fallback scenarios, (ix) presence of a predetermined function, (x)presence of a predetermined traffic situation, (xi) presence ofpredetermined weather, (xii) presence of a maximum possible time for aspecific performance or execution of one method step or a plurality ofmethod steps, (xiii) presence of a test result, that elements orfunctions, which are used for executing the method, are presentlyfunctioning correctly.
 3. The method as recited in claim 1, wherein theremote control signals are generated only when the at least one safetycondition is satisfied.
 4. The method as recited in claim 1, wherein thecheck as to whether the at least one safety condition is satisfied, iscarried out prior to and/or after and/or during one or morepredetermined method steps.
 5. The method as recited in claim 1, whereinafter the outputting of the remote control signals, remote control ofthe motor vehicle is tested based on the output remote control signalsin order to detect a fault, and wherein, in response to the detection ofa fault, the remote control is interrupted, or emergency remote controlsignals for controlling the motor vehicle remotely in an emergency aregenerated and output.
 6. The method as recited in claim 5, wherein thetesting of the remote control includes the check as to whether the atleast one safety condition is satisfied, and wherein the fault isdetermined when it is determined that the at least one safety conditionis not satisfied.
 7. The method as recited in claim 1, wherein thetesting of the remote control includes a check as to whether a result tobe achieved by the remote control is achieved, and wherein a fault isdetermined when a result of the check as to whether a result to beachieved by the remote control is achieved which indicates that theresult to be achieved by the remote control has not been achieved. 8.The method as recited in claim 7, wherein further remote control signalsfor controlling the motor vehicle remotely based on the result to beachieved are generated and outputted in order to achieve the result, andwherein the motor vehicle is controlled remotely based on the furtherremote control signals.
 9. The method as recited in claim 5, whereinemergency plan signals are received, which represent an emergency planspecific to the detected fault, and the emergency remote control signalsare generated based on the specific emergency plan.
 10. The method asrecited in claim 1, wherein the check as to whether the at least onesafety condition is satisfied, includes a check as to whether the atleast one safety condition is satisfied at a predetermined time.
 11. Themethod as recited in claim 1, further comprising the following steps:receiving situation signals which represent a situation in which themotor vehicle finds itself; receiving table signals which represent atable that affixes predetermined situations to predeterminedrequirements for controlling a motor vehicle remotely; and assigning thesituation in which the motor vehicle finds itself to one of thepredetermined situation; wherein the remote control signals aregenerated based on the requirement for controlling a motor vehicleremotely corresponding to the one predefined situation.
 12. The methodas recited in claim 1, wherein one or more method steps are executedinside the motor vehicle, and/or one or more of the method steps areexecuted outside of the motor vehicle in an infrastructure.
 13. Themethod as recited in claim 1, wherein one or more of the method stepsare executed outside of the motor vehicle in a cloud infrastructure. 14.The method as recited in claim 1, wherein the method steps aredocumented in a blockchain.
 15. The method as recited in claim 1,further comprising: testing whether an entity made up of the motorvehicle and infrastructure involved in the method, includingcommunication between the infrastructure and the motor vehicle, issecure.
 16. A device for controlling a motor vehicle remotely, thedevice configured to: receive safety condition signals, which representat least one safety condition that must be satisfied, so that the motorvehicle may be controlled remotely; check whether the at least onesafety condition is satisfied; generate remote control signals forcontrolling the motor vehicle remotely, based on a result of the checkas to whether the at least one safety condition is satisfied; and outputthe generated remote control signals.
 17. A non-transitorymachine-readable storage medium on which is stored a computer programfor controlling a motor vehicle remotely, the computer program, whenexecuted by a computer, causing the computer to perform the followingsteps: receiving safety condition signals, which represent at least onesafety condition that must be satisfied, so that the motor vehicle maybe controlled remotely; checking whether the at least one safetycondition is satisfied; generating remote control signals forcontrolling the motor vehicle remotely, based on a result of the checkas to whether the at least one safety condition is satisfied; andoutputting the generated remote control signals.